Loading malware…
RSOX is a Rust-based SOCKS proxy relay used to turn compromised Windows computers into network proxies. It tunnels traffic over WebSocket connections protected by TLS, supports token-based authentication, and exchanges JSON-formatted control messages. Its command set supports enabling and disabling SOCKS functionality, opening connections, transferring data, closing connections, checking connectivity, and terminating the tool.
RSOX is installed and executed through Microsoft Installer packages deployed after initial compromise. It has been used alongside GoGRPC, BlindDoor, RevSocket, PyGRPC, and S3Siphon in campaigns targeting corporate environments. These intrusions use Microsoft Teams voice phishing to impersonate IT support personnel and persuade employees to approve Microsoft Quick Assist remote-control sessions. RSOX provides post-compromise network tunneling through victim systems; command execution and file theft are supplied by other tools in the campaign.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
ThreatLabz analyzed the functionality of these tools along with the command-and-control (C2) communication methods used by the attackers.
The threat actor also deploys SOCKS proxy tools that also use gRPC or WebSockets to communicate with the C2 server.
RevSocket : proxy SOCKS inverse en Go ... PyGRPC : proxy SOCKS inverse en Python ... RSOX : ... proxy SOCKS relay
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Rust-based SOCKS relay/proxy delivered via MSI, using WebSocket over TLS, token authentication, and JSON-based command messaging for remote connectivity and control.
Supporting proxy tool used to route attacker traffic through compromised computers, facilitating further network access or concealing where traffic originates.
A tool used in the same campaign, likely supporting remote access or tunneling within the intrusion chain.
Additional malware used in the same campaigns alongside GoGRPC.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.